mobile device

Feb 09 2021

Let’s Protect More than 40% of our Endpoints

Imagine finding out your most recent departmental budget was only 40% of what it should be. If you’re like me, you’d get a strong feeling that “something is missing and it’s a real disaster.”

Well, here’s the thing. If you’re a CISO – or if your job involves information security in general – you should be getting that exact feeling right this minute. Because most businesses only secure 40% of their endpoints.

Clearly, no one thinks that 40% is good enough – whether it’s your budget or your endpoint protection strategy. So why would an otherwise buttoned-up, well-run enterprise security organization pursue a strategy that fails to protect 60% of their endpoints?

Mobile devices are now the most common endpoints in the enterprise

The problem, in a word, is mobile. Enterprises have had decades to plan, implement and iteratively refine robust management and security solutions for traditional endpoints like desktops and laptops. But mobile devices transformed almost overnight from a nice-to-have luxury into the single most critical endpoint in the enterprise for employee productivity, connectivity and collaboration.

Today, enterprises are still struggling to get their arms around protection for mobile devices. That struggle results in part from the vast difference between mobile threat defense and traditional threat defense. Unlike desktop PCs:

Users are the admins on mobile devices, so they decide when to upgrade their OS, what networks to connect to and what apps to install;
All apps are in containers on mobile devices, limiting the capabilities of security apps; and
Endpoint protection platforms (EPP) and endpoint detection and response (EDR) solutions are ineffective on mobile devices.

Mobile devices are under-protected and disproportionately targeted

Bad actors recognize that mobile endpoints are a relatively easy target. By September 2020, we had already recorded more mobile app breaches, failures, and data leaks than all of 2019.

Every day, Zimperium detects 600 million threat events involving enterprise mobile devices. Essentially, all the methods and strategies hackers use on traditional endpoints apply to mobile devices.

Targeted attacks against enterprises often use unknown, “zero day” attacks that require machine learning-based detection;
“Land and expand” campaigns target the weakest link for entry into the network – unprotected mobile devices are the hacker’s perfect starting point today; and
To maximize the ROI of compromising any system (including a mobile endpoint), hackers want to establish a persistent foothold that remains even after reboot.

Even aside from inadequate protection, mobile devices have inherent characteristics creating a larger attack surface than traditional endpoints. Cybercriminals can attack mobile devices from multiple vectors.

Device: Attackers’ primary goal on mobile is to fully compromise the device, be persistent, and weaponize it for “land and expand” lateral movements;
Network: Attackers use rogue access points (RAPs) and man-in-the- middle (MITMs) to steal data and deliver targeted exploits to compromise the device;
Phishing: Mobile phishing – especially via text/messaging apps and personal email – is a highly effective way to steal credentials and deliver targeted exploits; and
Apps: Malicious apps can create fraud, steal information, and deliver device exploits; even apps from legitimate sources can have coding or other errors that make them vulnerable.

All of this is to say that the endpoint security problem itself is huge. But the bigger picture is that when your endpoint security is compromised, all your information security is compromised. If 60% of your endpoints lack adequate management and security, you cannot succeed with security frameworks such as zero trust. But this is not to say that protecting mobile devices is a hopeless cause. Rather, it just requires a different approach.

EPP and EDR solutions can’t protect mobile devices, but MTD can

I mentioned earlier that EPP and EDR solutions are ineffective on mobile devices. The reasons for that are complex. For example, the kernels in mobile OSs such as Android, iOS and ChromeOS are locked down. And since EPP and EDR rely on kernel access, they are blind and ineffective on mobile.

They have no ability to detect risky or malicious networks, and cloud-based detection can easily be disabled by network attackers. They can’t even assess privacy and security risks in legitimate (non-malicious) mobile apps.

Mobile endpoints therefore require a new security approach. Gartner calls this new class of solutions mobile threat defense, or MTD. As the global leader in mobile threat defense protecting millions of enterprise mobile endpoints around the world, Zimperium’s MTD solution uniquely has the characteristics required for successful MTD:

Detects threats even with locked-down OS kernels;
Detects known and unknown (targeted) device, network, phishing and malicious app risks and attacks;
Provides on-device detection that protects user privacy and defends mobile devices even when an attacker owns the network and protects user privacy; and
Assesses privacy and security risks in legitimate mobile apps.

The Zimperium platform leverages our machine learning-based engine – z9 – to protect mobile data, apps and sessions against device compromises, network attacks, phishing attempts and malicious apps. Our solutions include zIPS which runs locally on any mobile device and detects cyberattacks without a connection to the cloud and our first-of-its-kind Mobile Application Protection Suite (MAPS), a comprehensive solution that helps organizations protect their mobile apps throughout their entire life cycle.

MAPS is comprised of three solutions: zScan, which helps organizations discover and fix compliance, privacy, and security issues; zShield, which hardens the app through obfuscation and anti-tampering; and zDefend (formerly zIAP), an SDK embedded in apps to help detect and defend against device, network, phishing and malicious app attacks while the app is in use.

For more information

If you’d like to get past the 40% mark and move to 100% endpoint protection, please feel free to reach out to me directly or to anyone at Zimperium. We are here to help.

Let’s Protect More than 40% of our Endpoints

Source

Feb 08 2021

Michigan Secure App – Powered by Zimperium – Protects Citizens from Mobile Attacks

Michigan Secure App - Powered by Zimperium - Protects Citizens from Mobile Attacks

According to a recent Michigan Department of Technology, Management and Budget (DTMB) news release, “the state of Michigan is now providing residents access to a free mobile application that can detect threats to their mobile devices. The Michigan Secure app alerts an individual of suspicious activity on their mobile device, allowing them to interact with the digital world with greater confidence.”

This is the latest zSecure app, developed by Zimperium, to provide citizens peace of mind by giving them free access to privacy-protecting, on-device protection for their mobile devices. Citizens in New York City and now Michigan citizens will be using the same solution – zIPS – used by top Fortune 100 companies and government agencies around the world.

“Our reliance on mobile devices has been met with a surge in activity by cybercriminals looking to access those devices to steal our personal information, and possibly much worse,” said DTMB Director and State Chief Information Officer Brom Stibitz. “The Michigan Secure app is a huge step towards protecting Michiganders from these criminals and giving us all some peace of mind as we use our phones and tablets.”

As with NYC Secure, Michigan Secure empowers users by informing them of the threats they encounter as they interact with an increasingly technology-driven world. The application warns users if the Wi-Fi they are trying to connect to could be compromised. It can also scan other Android mobile apps for potential threats and alert users before they are downloaded. Michigan Secure even has a database of potential threat indicators to notify individuals of activity on their phone that matches a documented threat.

“While the security of our mobile devices is critical, it is also important to respect people’s privacy,” explained Brom. “Michigan Secure does not require anyone to share their personal information or mobile data. It exists for the sole purpose of detecting threats and notifying the user.”

The Michigan Secure app – like NYC Secure – does not collect, store, or monitor the personal information of users that download it. The app’s code and privacy configuration settings have received the approval of the American Civil Liberties Union for the way they protect individual privacy.

[embedded content]

For more information

Michigan Secure is available for mobile devices running iOS 11 or higher, Android 6.0 or higher, and Chromebooks with Android Apps Support. You can download Michigan Secure on the App Store or Google Play. Visit Michigan.gov/MichiganSecureApp.

For Michiganders interested in learning more about how to protect themselves and their loved ones online, visit the Michigan Cybersecurity website at Michigan.gov/Cybersecurity for information ranging from how to practice proper cyber “hygiene” to learning about what to do if you are a victim of a cybercrime.

To learn more about Zimperium’s zSecure solution, contact us.

Michigan Secure App – Powered by Zimperium – Protects Citizens from Mobile Attacks

Source

Jan 29 2021

Apple’s Latest Security Fix Shows Why Enterprises Need MTD

Apple’s high-profile release of iOS 14.4, including security fixes for three critical vulnerabilities said to have been exploited by hackers in the wild, once again shows why enterprises need to deploy mobile threat defense (MTD) solutions.

Whether it is the Jeff Bezos hack or the ‘scariest iPhone hack ever,’ vulnerabilities open the door for hackers to initiate exploits, something only MTD solutions protect against.

According to multiple reports, including TechCrunch, “the technology giant said in its security update pages for iOS and iPadOS 14.4 that the three bugs affecting iPhones and iPads ‘may have been actively exploited.’ Details of the vulnerabilities are scarce, and an Apple spokesperson declined to comment beyond what’s in the advisory.”

Even with “scarce details” regarding the vulnerabilities, there are several points that should be addressed.

Mobile is always a target

This is yet another example of mobile being targeted in the wild, and why you need a solution that is built to detect threats throughout every part of the killchain (network/phishing/apps, etc).

The reality is, every day hackers are taking advantage of vulnerabilities. They are developing malicious apps, creating phishing campaigns and more, all in the name of stealing data, passwords, information and intelligence all found on mobile devices.

By September 2020, we had already recorded more mobile app breaches, failures, and data leaks than all of 2019. We detected a 6x increase in phishing sites in 2020 with hackers leveraging the pandemic and impersonating brands like Facebook, Microsoft and Amazon to dupe individuals. Scammers – masquerading as more than 25 different companies, brands and government agencies – used 265 Google Forms in an effort to steal user passwords and credentials.

Why are we seeing these increases in mobile cybercrime? Unfortunately, the bad guys know that many mobile devices – unlike laptops and desktops – are unprotected endpoints. These unprotected endpoints contain the same content as their protected brethren – all kinds of personal and work information, passwords, and data – and are now the de facto platform for productivity in business.

MDM, VPN and MFA aren’t the answers

All are great tools and serve specific purposes. Just not detecting these types of exploits. Mobile device management (MDM) is a management tool that works in concert with MTD. Virtual private networks (VPNs) provide access and secure the network connection, but are not built to protect compromised devices. Multi-factor authentication (MFA) provides zero protection in this context because it doesn’t assess the security posture of the device.

Why Zimperium

Zimperium is the global leader in mobile device and app security, offering the only real-time, on-device, multi-vector machine learning-based protection against Android, iOS and Chromebook threats. Powered by z9, we offer the most complete protection for mobile devices and apps against device, network, phishing and malicious app risks and attacks.

To that end, be sure to walk away from any company that guarantees protection, without first investigating the working exploits. The reality is, we don’t really have any information about the vulnerabilities themselves (as nothing was released besides “we patched this” and “it might have been exploited in the field”).

Whatever the exploit is, the attacker needs to get to the device first, this has to be done via phishing (which we’ll detect), a network attack (which we’ll detect) or an app (which in the iOS case has to be sideloaded – which we’ll detect). And even if the attacker managed to get to the device, their ultimate goal will be to gain persistence, which is something we’ll detect as well.

What we can say is we’ve detected 100 percent of zero-day device exploits in the wild without requiring an update or suffering from the delays and limitations of cloud-based detection or legacy security architectures – something no other mobile security provider can claim.

To learn more how we can help your enterprise, please contact us.

Apple’s Latest Security Fix Shows Why Enterprises Need MTD

Source

Jan 02 2021

Fintech Professional Says Challenger Banks are Disrupting Banking Sector in a “Big Way” by Improving Customer Experience

Last year, we saw many banking challengers offering services to customers who might not have been satisfied with their traditional bank. Many more people also began to use online banking services due to the COVID-19 pandemic which forced many physical business locations to shut down.

Marwan Forzley, Co-Founder and CEO at Align Commerce, a payment service provider for global commerce, notes in a blog post published by Payments Source that challenger banks are still quite small when compared to traditional financial institutions. But they’re “disrupting” the banking sector in a “big way” by changing “the fundamental and antiquated experience we’ve come to expect.”

Forzley points out that Deloitte’s “DNA of Digital Challenger Banks” report states that “challengers have developed a product offering and channel experience that targets the points of the value chain where incumbents’ weaknesses are most exposed and often not easy to fix.” In 2020, we saw Fintech challengers (like Current) offer certain services that cater to the financially underserved — such as SMEs, Millennials and underbanked consumers, Forzley confirmed.

He added that digital-only banks (like Revolut) have launched services that specifically aim to serve corporate or business clients. They may offer advanced tools and features (for example, access to working capital, accounting integrations, online wallets, and payment scheduling). These tools may be accessed from a laptop or mobile device — “without the processes, complexities or red tape that incumbents are known for,” Forzley claims.

He also mentioned that there’s a “wide open market with plenty of opportunity not just for challenger banks but for financial technology as an industry to set themselves apart from incumbents to gain market share.”

In 2020, we saw an “unprecedented” level of investment into Fintech firms, Forzley noted. He pointed out that the opportunity for growth within the payment and banking sector is driven by the need to solve or address clear problems and develop “tech-forward solutions” that are “readily available” to serve individuals and companies. He claims that VCs and incumbents are interested in funding “innovative, agile products and services that improve on the speed, accessibility and transparency issues that are widespread throughout traditional financial institutions.”

He concluded:

“[The] winners will be determined by how novel their offering is. In order for the leaders in the space to survive against incumbents and against each other, challengers will need to focus on ensuring their services are more innovative and different compared to what exists today. If the service is going to yield minor incremental changes, it won’t be enough for the challenger to truly take off. The services that will do well are the ones providing a fundamentally different and forward-thinking customer experience.”

As reported recently, digital banks and Fintech challengers must show they can generate profits, because investors are expecting returns.

Investors have been pushing banking challengers to show them how they can generate sizable profits by effectively monetizing their products and services. Industry analysts expect that the neo-banking sector will have to consider consolidation opportunities and seriously begin to focus on achieving profitability in a post COVID environment.

As covered, Fintech adoption is on the rise globally with over 250 digital banks operating in major financial markets, according to a new report from Exton.

The report noted:

“On their quest for monetizing customer relationships neobanks have learned a first lesson: payment transaction fees, premium account subscription fees, or open banking commissions from brokering 3rd party services will in most cases not be sufficient to generate profits or breach beyond operational break-even. Our expectation much rather is that Neobanks will need to offer additional products to jump the gap to sizable profitability.”

The report added:

“Irrespective of which path neobanks will take, we remain convinced that they will need to shift into profitability mode quickly as investor patience will not be unlimited. But for those that select the paths right for them, stay focused on it and grow up as an organization, the future remains bright and full of opportunities.”

Exton suggests that some Fintechs or neobanks may want to consider offering digital or lending services which should help them diversify their business. Financial technology firms can also look into developing their own super app or offer investment services to the mass affluent market, Exton noted.

Source

Dec 22 2020

Millions Stolen from US and EU Banks Could’ve Been Prevented

Millions stolen from US and EU banks could’ve been prevented. According to a recent Ars Technica article, “Researchers from IBM Trusteer say they’ve uncovered a massive fraud operation that used a network of mobile device emulators to drain millions of dollars from online bank accounts in a matter of days.

“The scale of the operation was unlike anything the researchers have seen before. In one case, crooks used about 20 emulators to mimic more than 16,000 phones belonging to customers whose mobile bank accounts had been compromised. The thieves then entered usernames and passwords into banking apps running on the emulators and initiated fraudulent money orders that siphoned funds out of the compromised accounts. Emulators are used by legitimate developers and researchers to test how apps run on a variety of different mobile devices.

The article goes on to say, “To bypass protections banks use to block such attacks, the crooks used device identifiers corresponding to each compromised account holder and spoofed GPS locations the device was known to use. The device IDs were likely obtained from the holders’ hacked devices, although in some cases, the fraudsters gave the appearance that they were customers who were accessing their accounts from new phones. The attackers were also able to bypass multi-factor authentication by accessing SMS messages.”

Zimperium protects mobile apps

The reality is, mobile attacks are rampant and increasingly sophisticated today. They cause huge damage to profitability, reputation and brand value. Zimperium, the global leader in mobile device and app security, allows customers to detect and prevent more mobile threats, with the least amount of organizational friction, than any alternative.

Based on what is known about this incident publicly, our Mobile Application Protection Suite (MAPS) platform would have provided real time detection and protections against this type of attack. We would have done so in three ways:

First, we help developers and security teams reduce risks in their application by integrating our zScan app scanning tool into the software development life cycle (SDLC).
Second, our zShield obfuscation technology hardens applications from reverse engineering and other techniques that are used by attackers to clone or better understand target applications to mount this type of campaign.
Third, and finally, our zDefend software development kit (SDK) enables developers to quickly and painlessly embed Zimperium’s leading machine learning-based detection engine, z9, directly inside any mobile app. zDefend would have detected that the app was installed on a compromised device, or emulator, and detected the app tampering or app hooking techniques that were likely used by the attacker to automate their campaign at scale.

With the zDefend SDK embedded, mobile apps can immediately determine if a user’s device is compromised, if the app is running on an emulator, any network attacks are occurring and even if malicious apps are installed. zDefend is completely configurable by app developers, who can select whatever remedial action should apply when a given threat is detected. When a device or the app is under attack, zDefend informs the app and initiates those predetermined risk mitigation actions.

The embedded zDefend provides robust and granular detections and defenses against many risks and threats, including specific events that were likely part of this attack, such as:

If the application is installed on an emulator.
If the application is being tampered with or hooked. Typically a key step for attackers trying to reverse an application, or automate fraud at scale.
A device has malware like BankBot installed, the app can trigger immediate steps to freeze access until the user deletes the BankBot-carrying app and resets their password online.
A device has been jailbroken by the user, the app can allow the session to continue, but raise the user’s fraud score to account for the additional risk.
A device has been compromised by an external actor, the app can display a dialog box asking the user to complete their transaction offline.

With these and many more detection capabilities provided by zDefend, customers can initiate proactive remediations and mitigation actions both in the application, and on the back end, with detailed forensics and visibility to prevent this type of fraud and theft from happening in the first place. When combined with zScan and zShield as part of the overall MAPS platform, Zimperium can help customers secure and defend their mobile applications during the entire lifecycle of the application.

Contact us

To learn more how we can help, please contact us.

Millions Stolen from US and EU Banks Could’ve Been Prevented

Source